- VOLTA steals wallet recovery phrases, passwords and active sessions before it contacts an AI model.
- Claude is the default model. If it refuses, the malware can try Kimi or Gemini.
- An AI refusal does not stop the theft. The operator can still receive the stolen records through Telegram.
VOLTA malware steals data from Windows computers, then asks an AI model which of a victim’s assets could bring in the most money. In an October 31 report, Cisco Talos researcher Ryan Fetterman described how the program connects crypto wallet records with details from email receipts, browser sessions and workplace accounts. The result helps an attacker decide which accounts to pursue first.
How VOLTA Malware Connects Wallet Data to a Real Person
The Windows infostealer searches for wallet recovery phrases and attempts to crack encrypted wallet vaults. Its reach extends beyond crypto: it also collects browser passwords, saved payment card details and credentials for cloud services.
A delivery receipt illustrates how the records fit together. Using a stolen Gmail session, VOLTA malware can find an address in an order confirmation and check it against other location data. A Slack workspace can identify a likely employer, while a gaming account can reveal digital items with resale value.
The software assembles those records before requesting an assessment. It asks the model to rank assets and flag weaknesses such as poor password practices.
That ranking is an estimate based on what the infected computer reveals. It cannot establish the owner’s total wealth or prove that an attacker has emptied a wallet.
Why an AI Refusal Does Not Stop VOLTA Malware From Stealing
Through OpenRouter, the software first requests an assessment from Anthropic’s Claude Opus 4.6. If the model declines or gives too little information, VOLTA malware can try Moonshot AI’s Kimi K2 and Google’s Gemini 2.5 Flash. Without an OpenRouter key, it can still send the underlying records through Telegram.
For anyone investigating an infection, the program may leave evidence even after it deletes its main executable. Talos identifies volta_debug.txt as a log worth preserving: it can show what the program collected and whether the AI request succeeded.
A wallet password change cannot protect funds if someone has copied the recovery phrase. For a phrase stored in readable form on the infected computer, Talos advises transferring the assets to a new wallet with a fresh recovery phrase.
Disclaimer: This article is for informational purposes only and does not constitute financial advice. CoinCryptoNewz is not responsible for any losses incurred. Readers should do their own research before making financial decisions.
